sshsig.sh revision 1.6
1# $OpenBSD: sshsig.sh,v 1.6 2021/07/23 03:54:55 djm Exp $ 2# Placed in the Public Domain. 3 4tid="sshsig" 5 6DATA2=$OBJ/${DATANAME}.2 7cat ${DATA} ${DATA} > ${DATA2} 8 9rm -f $OBJ/sshsig-*.sig $OBJ/wrong-key* $OBJ/sigca-key* 10 11sig_namespace="test-$$" 12sig_principal="user-$$@example.com" 13 14# Make a "wrong key" 15${SSHKEYGEN} -q -t ed25519 -f $OBJ/wrong-key \ 16 -C "wrong trousers, Grommit" -N '' \ 17 || fatal "couldn't generate key" 18WRONG=$OBJ/wrong-key.pub 19 20# Make a CA key. 21${SSHKEYGEN} -q -t ed25519 -f $OBJ/sigca-key -C "CA" -N '' \ 22 || fatal "couldn't generate key" 23CA_PRIV=$OBJ/sigca-key 24CA_PUB=$OBJ/sigca-key.pub 25 26trace "start agent" 27eval `${SSHAGENT} ${EXTRA_AGENT_ARGS} -s` > /dev/null 28r=$? 29if [ $r -ne 0 ]; then 30 fatal "could not start ssh-agent: exit code $r" 31fi 32 33SIGNKEYS="$SSH_KEYTYPES" 34verbose "$tid: make certificates" 35for t in $SSH_KEYTYPES ; do 36 ${SSHKEYGEN} -q -s $CA_PRIV -z $$ \ 37 -I "regress signature key for $USER" \ 38 -n $sig_principal $OBJ/${t} || \ 39 fatal "couldn't sign ${t}" 40 SIGNKEYS="$SIGNKEYS ${t}-cert.pub" 41done 42 43for t in $SIGNKEYS; do 44 verbose "$tid: check signature for $t" 45 keybase=`basename $t .pub` 46 privkey=${OBJ}/`basename $t -cert.pub` 47 sigfile=${OBJ}/sshsig-${keybase}.sig 48 sigfile_agent=${OBJ}/sshsig-agent-${keybase}.sig 49 pubkey=${OBJ}/${keybase}.pub 50 51 ${SSHKEYGEN} -vvv -Y sign -f ${OBJ}/$t -n $sig_namespace \ 52 < $DATA > $sigfile 2>/dev/null || fail "sign using $t failed" 53 54 (printf "$sig_principal " ; cat $pubkey) > $OBJ/allowed_signers 55 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 56 -I $sig_principal -f $OBJ/allowed_signers \ 57 < $DATA >/dev/null 2>&1 || \ 58 fail "failed signature for $t key" 59 60 (printf "$sig_principal namespaces=\"$sig_namespace,whatever\" "; 61 cat $pubkey) > $OBJ/allowed_signers 62 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 63 -I $sig_principal -f $OBJ/allowed_signers \ 64 < $DATA >/dev/null 2>&1 || \ 65 fail "failed signature for $t key w/ limited namespace" 66 67 # Invalid option 68 (printf "$sig_principal octopus " ; cat $pubkey) > $OBJ/allowed_signers 69 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 70 -I $sig_principal -f $OBJ/allowed_signers \ 71 < $DATA >/dev/null 2>&1 && \ 72 fail "accepted signature for $t key with bad signers option" 73 74 # Wrong key trusted. 75 (printf "$sig_principal " ; cat $WRONG) > $OBJ/allowed_signers 76 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 77 -I $sig_principal -f $OBJ/allowed_signers \ 78 < $DATA >/dev/null 2>&1 && \ 79 fail "accepted signature for $t key with wrong key trusted" 80 81 # incorrect data 82 (printf "$sig_principal " ; cat $pubkey) > $OBJ/allowed_signers 83 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 84 -I $sig_principal -f $OBJ/allowed_signers \ 85 < $DATA2 >/dev/null 2>&1 && \ 86 fail "passed signature for wrong data with $t key" 87 88 # wrong principal in signers 89 (printf "josef.k@example.com " ; cat $pubkey) > $OBJ/allowed_signers 90 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 91 -I $sig_principal -f $OBJ/allowed_signers \ 92 < $DATA >/dev/null 2>&1 && \ 93 fail "accepted signature for $t key with wrong principal" 94 95 # wrong namespace 96 (printf "$sig_principal " ; cat $pubkey) > $OBJ/allowed_signers 97 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n COWS_COWS_COWS \ 98 -I $sig_principal -f $OBJ/allowed_signers \ 99 < $DATA >/dev/null 2>&1 && \ 100 fail "accepted signature for $t key with wrong namespace" 101 102 # namespace excluded by option 103 (printf "$sig_principal namespaces=\"whatever\" " ; 104 cat $pubkey) > $OBJ/allowed_signers 105 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 106 -I $sig_principal -f $OBJ/allowed_signers \ 107 < $DATA >/dev/null 2>&1 && \ 108 fail "accepted signature for $t key with excluded namespace" 109 110 ( printf "$sig_principal " ; 111 printf "valid-after=\"19800101\",valid-before=\"19900101\" " ; 112 cat $pubkey) > $OBJ/allowed_signers 113 114 # key lifespan valid 115 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 116 -I $sig_principal -f $OBJ/allowed_signers \ 117 -Overify-time=19850101 \ 118 < $DATA >/dev/null 2>&1 || \ 119 fail "failed signature for $t key with valid expiry interval" 120 # key not yet valid 121 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 122 -I $sig_principal -f $OBJ/allowed_signers \ 123 -Overify-time=19790101 \ 124 < $DATA >/dev/null 2>&1 && \ 125 fail "failed signature for $t not-yet-valid key" 126 # key expired 127 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 128 -I $sig_principal -f $OBJ/allowed_signers \ 129 -Overify-time=19910101 \ 130 < $DATA >/dev/null 2>&1 && \ 131 fail "failed signature for $t with expired key" 132 # NB. assumes we're not running this test in the 1980s 133 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 134 -I $sig_principal -f $OBJ/allowed_signers \ 135 < $DATA >/dev/null 2>&1 && \ 136 fail "failed signature for $t with expired key" 137 138 # public key in revoked keys file 139 cat $pubkey > $OBJ/revoked_keys 140 (printf "$sig_principal namespaces=\"whatever\" " ; 141 cat $pubkey) > $OBJ/allowed_signers 142 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 143 -I $sig_principal -f $OBJ/allowed_signers \ 144 -r $OBJ/revoked_keys \ 145 < $DATA >/dev/null 2>&1 && \ 146 fail "accepted signature for $t key, but key is in revoked_keys" 147 148 # public key not revoked, but others are present in revoked_keysfile 149 cat $WRONG > $OBJ/revoked_keys 150 (printf "$sig_principal " ; cat $pubkey) > $OBJ/allowed_signers 151 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 152 -I $sig_principal -f $OBJ/allowed_signers \ 153 -r $OBJ/revoked_keys \ 154 < $DATA >/dev/null 2>&1 || \ 155 fail "couldn't verify signature for $t key, but key not in revoked_keys" 156 157 # check-novalidate with valid data 158 ${SSHKEYGEN} -vvv -Y check-novalidate -s $sigfile -n $sig_namespace \ 159 < $DATA >/dev/null 2>&1 || \ 160 fail "failed to check valid signature for $t key" 161 162 # check-novalidate with invalid data 163 ${SSHKEYGEN} -vvv -Y check-novalidate -s $sigfile -n $sig_namespace \ 164 < $DATA2 >/dev/null 2>&1 && \ 165 fail "succeeded checking signature for $t key with invalid data" 166 167 # Check signing keys using ssh-agent. 168 ${SSHADD} -D >/dev/null 2>&1 # Remove all previously-loaded keys. 169 ${SSHADD} ${privkey} > /dev/null 2>&1 || fail "ssh-add failed" 170 171 # Move private key to ensure agent key is used 172 mv ${privkey} ${privkey}.tmp 173 174 ${SSHKEYGEN} -vvv -Y sign -f $pubkey -n $sig_namespace \ 175 < $DATA > $sigfile_agent 2>/dev/null || \ 176 fail "ssh-agent based sign using $pubkey failed" 177 ${SSHKEYGEN} -vvv -Y check-novalidate -s $sigfile_agent \ 178 -n $sig_namespace < $DATA >/dev/null 2>&1 || \ 179 fail "failed to check valid signature for $t key" 180 181 # Move private key back 182 mv ${privkey}.tmp ${privkey} 183 184 # Remaining tests are for certificates only. 185 case "$keybase" in 186 *-cert) ;; 187 *) continue ;; 188 esac 189 190 191 # correct CA key 192 (printf "$sig_principal cert-authority " ; 193 cat $CA_PUB) > $OBJ/allowed_signers 194 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 195 -I $sig_principal -f $OBJ/allowed_signers \ 196 < $DATA >/dev/null 2>&1 || \ 197 fail "failed signature for $t cert" 198 199 # signing key listed as cert-authority 200 (printf "$sig_principal cert-authority " ; 201 cat $pubkey) > $OBJ/allowed_signers 202 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 203 -I $sig_principal -f $OBJ/allowed_signers \ 204 < $DATA >/dev/null 2>&1 && \ 205 fail "accepted signature with $t key listed as CA" 206 207 # CA key not flagged cert-authority 208 (printf "$sig_principal " ; cat $CA_PUB) > $OBJ/allowed_signers 209 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 210 -I $sig_principal -f $OBJ/allowed_signers \ 211 < $DATA >/dev/null 2>&1 && \ 212 fail "accepted signature for $t cert with CA not marked" 213 214 # mismatch between cert principal and file 215 (printf "josef.k@example.com cert-authority " ; 216 cat $CA_PUB) > $OBJ/allowed_signers 217 ${SSHKEYGEN} -vvv -Y verify -s $sigfile -n $sig_namespace \ 218 -I $sig_principal -f $OBJ/allowed_signers \ 219 < $DATA >/dev/null 2>&1 && \ 220 fail "accepted signature for $t cert with wrong principal" 221done 222 223trace "kill agent" 224${SSHAGENT} -k > /dev/null 225 226